@getstrata/core 0.5.42 → 0.5.43

package/dist/entries/admin/formatValue.js

@@ -0,0 +1,32 @@
+// @bun
+// ../../src/core/admin/formatValue.ts
+function formatAdminValue(value, type = "text") {
+  if (value === null || value === undefined) {
+    return "";
+  }
+  if (type === "boolean") {
+    return value ? "yes" : "no";
+  }
+  if (type === "number") {
+    return String(value);
+  }
+  if (type === "datetime") {
+    if (value instanceof Date) {
+      return value.toISOString();
+    }
+    return String(value);
+  }
+  if (type === "code") {
+    if (typeof value === "string") {
+      return value;
+    }
+    return JSON.stringify(value, null, 2);
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+export {
+  formatAdminValue
+};

package/dist/entries/admin/registry.js

@@ -0,0 +1,32 @@
+// @bun
+// ../../src/core/admin/registry.ts
+class AdminResourceRegistry {
+  resources = new Map;
+  constructor() {}
+  register(resource) {
+    if (this.resources.has(resource.name)) {
+      throw new Error(`Admin resource "${resource.name}" is already registered.`);
+    }
+    this.resources.set(resource.name, resource);
+  }
+  get(name) {
+    return this.resources.get(name);
+  }
+  list() {
+    const definitions = [];
+    for (const resource of this.resources.values()) {
+      const { handlers: _handlers, ...definition } = resource;
+      definitions.push(definition);
+    }
+    return definitions;
+  }
+  all() {
+    return [...this.resources.values()];
+  }
+  clear() {
+    this.resources.clear();
+  }
+}
+export {
+  AdminResourceRegistry
+};

package/dist/entries/audit/siemFormatter.js

@@ -0,0 +1,37 @@
+// @bun
+// ../../src/core/audit/siemFormatter.ts
+function formatSiemAuditEvent(input) {
+  return {
+    timestamp: input.created_at.toISOString(),
+    event_type: "workhub.audit",
+    actor_user_id: input.user_id,
+    tenant_id: input.tenant_id ?? null,
+    trace_id: input.trace_id ?? null,
+    action: input.action,
+    subject_type: input.subject_type,
+    subject_id: input.subject_id,
+    ip_address: input.ip_address ?? null,
+    user_agent: input.user_agent ?? null,
+    checksum: input.checksum ?? null,
+    payload: input.payload ?? {}
+  };
+}
+function formatCefLine(event) {
+  const extension = [
+    `rt=${event.timestamp}`,
+    `suid=${event.actor_user_id ?? "unknown"}`,
+    `cs1=${event.action}`,
+    `cs1Label=Action`,
+    `cs2=${event.subject_type}`,
+    `cs2Label=SubjectType`,
+    `cs3=${event.subject_id ?? ""}`,
+    `cs3Label=SubjectId`,
+    `src=${event.ip_address ?? ""}`,
+    `request=${event.trace_id ?? ""}`
+  ].join(" ");
+  return `CEF:0|WorkHub|API|1.0|${event.action}|${event.subject_type}|5|${extension}`;
+}
+export {
+  formatSiemAuditEvent,
+  formatCefLine
+};

package/dist/entries/auth/scimAuthMiddleware.js

@@ -0,0 +1,241 @@
+// @bun
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function bindDatabaseConnection(connection) {
+  boundConnectionHolder.connection = connection;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+function resetBoundDatabaseConnection() {
+  boundConnectionHolder.connection = null;
+}
+
+// ../../src/core/database/bindConnection.ts
+function bindDatabaseConnection2(connection) {
+  bindDatabaseConnection(connection);
+}
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+
+// ../../src/core/database/connectionContext.ts
+var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
+function runWithDatabaseConnection(connection, callback) {
+  return activeConnection.run(connection, callback);
+}
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+function hasActiveDatabaseConnection() {
+  return activeConnection.getStore() !== undefined;
+}
+
+// ../../src/core/database/queryProxy.ts
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function createDatabaseQueryProxy(pool) {
+  function resolveDatabase() {
+    return getActiveDatabaseConnection(pool);
+  }
+  function resolveDatabaseForProperty(property) {
+    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+      return pool;
+    }
+    return resolveDatabase();
+  }
+  return new Proxy(function database() {}, {
+    apply(_target, _thisArg, args) {
+      return resolveDatabase()(...args);
+    },
+    get(_target, property) {
+      const connection = resolveDatabaseForProperty(property);
+      const value = connection[property];
+      return typeof value === "function" ? value.bind(connection) : value;
+    }
+  });
+}
+
+// ../../src/core/database/defaultConnection.ts
+var defaultPool = {
+  connection: null
+};
+var defaultQuery = {
+  connection: null
+};
+function registerDefaultDatabasePool(connection) {
+  defaultPool.connection = connection;
+  defaultQuery.connection = createDatabaseQueryProxy(connection);
+}
+function getDefaultDatabasePool() {
+  if (!defaultPool.connection) {
+    throw new Error("Default database pool is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultPool.connection;
+}
+function getDefaultDatabaseQuery() {
+  if (!defaultQuery.connection) {
+    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
+  }
+  return defaultQuery.connection;
+}
+
+// ../../src/domain/scim.ts
+var TEST_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+
+// ../../src/core/security/timingSafeCompare.ts
+import { timingSafeEqual } from "crypto";
+function timingSafeCompareString(left, right) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  if (leftBuffer.length !== rightBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+// ../../src/core/security/scimTenantTokens.ts
+function parseScimTenantTokens(raw) {
+  const tokens = new Map;
+  if (!raw?.trim()) {
+    return tokens;
+  }
+  for (const entry of raw.split(",")) {
+    const [tenantPart, tokenPart] = entry.split(":");
+    if (!tenantPart || !tokenPart) {
+      continue;
+    }
+    const tenantId = Number.parseInt(tenantPart.trim(), 10);
+    const token = tokenPart.trim();
+    if (Number.isInteger(tenantId) && tenantId > 0 && token.length > 0) {
+      tokens.set(tenantId, token);
+    }
+  }
+  return tokens;
+}
+function resolveScimTenantFromToken(token) {
+  const tenantTokens = parseScimTenantTokens(process.env.SCIM_TENANT_TOKENS);
+  for (const [tenantId, expectedToken] of tenantTokens) {
+    if (timingSafeCompareString(token, expectedToken)) {
+      return tenantId;
+    }
+  }
+  const fallbackToken = process.env.SCIM_BEARER_TOKEN ?? TEST_SCIM_BEARER_TOKEN;
+  if (timingSafeCompareString(token, fallbackToken)) {
+    return 1;
+  }
+  return null;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? getDefaultDatabaseQuery();
+}
+var repositoryConnection = new Proxy(function repositoryConnection2() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveRepositoryConnection()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
+// ../../src/core/tenant/resolveTenant.ts
+async function resolveTenant(tenantId) {
+  const rows = await repositoryConnection`
+    SELECT id, slug, plan, region
+    FROM tenant
+    WHERE id = ${tenantId}
+    LIMIT 1
+  `;
+  const row = rows[0];
+  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
+}
+
+// ../../src/core/tenant/tenantContext.ts
+var tenantContext = createAsyncContextStore("@getstrata/tenantContext");
+function runWithTenant(tenant, callback) {
+  return tenantContext.run(tenant, callback);
+}
+function currentTenant() {
+  return tenantContext.getStore() ?? null;
+}
+function currentTenantId() {
+  return currentTenant()?.id ?? 1;
+}
+
+// ../../src/core/tenant/tenantDatabaseScope.ts
+async function applyTenantContextToTransaction(transaction, tenantId) {
+  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
+  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
+}
+async function runWithTenantDatabase(tenant, callback) {
+  if (hasActiveDatabaseConnection()) {
+    const activeConnection2 = getActiveDatabaseConnection(getDefaultDatabasePool());
+    await applyTenantContextToTransaction(activeConnection2, tenant.id);
+    return await runWithTenant(tenant, callback);
+  }
+  return await getDefaultDatabasePool().begin(async (transaction) => {
+    await applyTenantContextToTransaction(transaction, tenant.id);
+    return await runWithDatabaseConnection(transaction, async () => {
+      return await runWithTenant(tenant, callback);
+    });
+  });
+}
+function isInsideTenantDatabaseScope(tenantId = currentTenant()?.id) {
+  return hasActiveDatabaseConnection() && currentTenant()?.id === tenantId;
+}
+
+// ../../src/core/auth/scimAuthMiddleware.ts
+function createScimAuthMiddleware() {
+  return async (request, next) => {
+    const authorization = request.headers.get("authorization");
+    if (!authorization?.startsWith("Bearer ")) {
+      return jsonScimError("SCIM bearer token required.", 401);
+    }
+    const token = authorization.slice("Bearer ".length).trim();
+    const tenantId = resolveScimTenantFromToken(token);
+    if (tenantId === null) {
+      return jsonScimError("Invalid SCIM bearer token.", 401);
+    }
+    const tenant = await resolveTenant(tenantId);
+    if (!tenant) {
+      return jsonScimError("SCIM tenant not found.", 401);
+    }
+    return await runWithTenantDatabase(tenant, async () => {
+      bindDatabaseConnection2(getActiveDatabaseConnection(getDefaultDatabasePool()));
+      try {
+        return await next();
+      } finally {
+        resetBoundDatabaseConnection();
+      }
+    });
+  };
+}
+function jsonScimError(detail, status) {
+  return Response.json({
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:Error"],
+    detail,
+    status: String(status)
+  }, {
+    status,
+    headers: { "content-type": "application/scim+json" }
+  });
+}
+export {
+  createScimAuthMiddleware
+};

package/dist/entries/auth/sessionGuard.js

@@ -2131,6 +2131,45 @@ class Blueprint {
     });
   }
 }
+// ../../src/core/database/schema/driver.ts
+function normalizeConnectionName(connection) {
+  const normalized = connection.trim().toLowerCase();
+  if (normalized === "pgsql" || normalized === "postgres" || normalized === "postgresql") {
+    return "pgsql";
+  }
+  if (normalized === "mysql" || normalized === "mariadb") {
+    return "mysql";
+  }
+  if (normalized === "sqlite") {
+    return "sqlite";
+  }
+  throw new Error(`Unsupported DB_CONNECTION: ${connection}`);
+}
+function resolveDriverFromUrl(url) {
+  const normalized = url.trim().toLowerCase();
+  if (normalized.startsWith("postgres://") || normalized.startsWith("postgresql://") || normalized.startsWith("postgres:")) {
+    return "pgsql";
+  }
+  if (normalized.startsWith("mysql://") || normalized.startsWith("mysql:")) {
+    return "mysql";
+  }
+  if (normalized.startsWith("sqlite:")) {
+    return "sqlite";
+  }
+  return null;
+}
+function resolveDatabaseDriver(options = {}) {
+  const connection = options.connection ?? process.env.DB_CONNECTION;
+  if (connection) {
+    return normalizeConnectionName(connection);
+  }
+  const url = options.url ?? process.env.DATABASE_URL ?? "";
+  const fromUrl = resolveDriverFromUrl(url);
+  if (fromUrl) {
+    return fromUrl;
+  }
+  return "pgsql";
+}
 // ../../src/core/database/schema/errors.ts
 class UnsupportedSchemaFeatureError extends Error {
   constructor(feature, driver) {
@@ -2475,6 +2514,25 @@ class SchemaBuilder {
     }
   }
 }
+
+class Schema {
+  static builder(driver) {
+    return new SchemaBuilder(driver ?? resolveDatabaseDriver());
+  }
+  static async run(db, driver, callback) {
+    const schema = Schema.builder(driver);
+    await callback(schema);
+    await schema.execute(db);
+  }
+}
+function createSchemaBuilder(db, driver) {
+  const builder = Schema.builder(driver);
+  return Object.assign(builder, {
+    async commit() {
+      await builder.execute(db);
+    }
+  });
+}
 // ../../src/core/database/table.ts
 function defineTable(definition) {
   return definition;